That's why I always raise concerns about JEP 411 - removal of SecurityManager from Java without any replacement.